Hi,

I want to write a script which can generate a kill list for killing process, program name start with f60.., which have been running for more than 8 hours, the list output should looks like:

kill -9 4444176
kill -9 4674520
kill -9 4454180
kill -9 4994523

Can anyone help how to write it?

Thanks!
Victor Cheung

The "suitable options" and the field numbers to use in the awk script depend on which platform you are on. Consider this pseudo-code.

Are you sure you understand the consequences of "kill -9"? You should use a less drastic signal if at all possible.

Here's something for Linux.

Hi Era,

I use the following in AIX :

ps aux | awk '$11 ~ /(^|\/)f60/ { split ($9,t,/:/); if (t[1] > 8) print $2 }'

and it return:

4468962

and I grep the process:
root@lkmprod11i:/home/oracle/victor> ps -ef|grep 4468962
appl115 4468962 6123696 0 09:05:04 - 0:00 f60runm webfile=5,27368,lkmprod11i_9002_PROD11i
root 9077560 10519380 0 15:15:38 pts/0 0:00 grep 4468962

The program start time is 09:05 and the system current time is 15:15, it is less then 8 hours long, it should not be returned, can you please help and review? Thanks!

On the other hand, I have to add one more condition to it, if the process id or parent process id is 1 then don't let it returned, how to do that?

Thanks!
Victor Cheung

The PPID is not visible in the ps aux output, you might need different options to get that column also. Then it should be a trivial problem to add '&& $3 > 1' with the correct field number of course before the opening curly.

You want the [f] with the square brackets, otherwise you risk to kill the script itself (in theory, mostly, I guess, in the current scenario; but what if you repurpose the script later? Better make it right).

Hi Era,

Sorry, I have edited my post:

I use the following in AIX :

ps aux | awk '$11 ~ /(^|\/)f60/ { split ($9,t,/:/); if (t[1] > 8) print $2 }'

and it return:

4468962

and I grep the process:
root@lkmprod11i:/home/oracle/victor> ps -ef|grep 4468962
appl115 4468962 6123696 0 09:05:04 - 0:00 f60runm webfile=5,27368,lkmprod11i_9002_PROD11i
root 9077560 10519380 0 15:15:38 pts/0 0:00 grep 4468962

The program start time is 09:05 and the system current time is 15:15, it is less then 8 hours long, it should not be returned, can you please help and review? Thanks!


Victor Cheung

Check man ps for an option which list the actual run time. (Apparently you want wall clock time, not CPU time -- that might not be directly available. Then you need to do some time calculations in awk, which doesn't sounds like much fun.)

Thanks Era.

Hi Era,

I have the list produced by :

ps -ef -o "user pid ppid cpu etime tty time args"

and the output looks like:

oracle 1626616 1 0 37-05:24:09 - 00:06:29 oracleDEV (LOCAL=NO)
oracle 1638908 1 0 37-05:24:09 - 00:06:24 oracleDEV (LOCAL=NO)
oracle 1642760 1 0 37-05:24:08 - 00:06:23 oracleDEV (LOCAL=NO)
oracle 1651012 1 0 26-01:15:11 - 00:02:07 oracleDEV (LOCAL=NO)
oracle 1655052 1 0 37-05:24:08 - 00:06:22 oracleDEV (LOCAL=NO)
oracle 1659266 1 4 01:14:16 - 00:01:49 oracleDEV (LOCAL=NO)
oracle 1712408 1 0 36-04:08:24 - 00:06:26 oracleDEV (LOCAL=NO)
oracle 1720698 1 0 05:27 - 00:00:00 oracleDEV (LOCAL=NO)
oracle 1728950 1 0 14-06:37:31 - 00:02:33 oracleDEV (LOCAL=NO)
oracle 1732902 1 0 01:52:11 - 00:00:01 oracleDEV (LOCAL=NO)
oracle 1737166 1 0 08:32:27 - 00:00:10 oracleDEV (LOCAL=NO)
oracle 1745166 1 0 08:57:59 - 00:00:18 oracleDEV (LOCAL=NO)
oracle 1753436 1 0 01:24:40 - 00:00:01 oracleDEV (LOCAL=NO)
oracle 1765692 1 0 01:28:10 - 00:00:01 oracleDEV (LOCAL=NO)

The 3rd column is the elapsed time and in Format of [[ dd-]hh:]mm:ss, is it possible I only want it to return the PIDs for processes elapsed longer than 8 hours?

if I issue :
ps -ef -o "user pid ppid cpu etime tty time args" | awk '$8 ~ /(^|\/)[f]60/ && $3>1 { print $2 }'

it returns all the PIDs regardless of elapsed time, can you please advise how to modify the script and let it return only processes elapsed longer than 8 hours?


Many thanks!
Victor Cheung

It prints nothing at all for me, the processes are not called f60 and $3 is not greater than 1.

But to focus on the elapsed time, you could say $5 ~ /[0-9]-/ for anything with more than one day (trivially more than 8h then) and for the remaining ones, split($5, t, /:/) and print if t[1] > 8.

Thanks Era!